ISC2 CISSP (Certified Information Systems Security Professional)Asset SecurityMedium
A multinational corporation is implementing a new global data handling policy. They have identified that certain customer data, while not explicitly classified as 'confidential,' must only be collected and processed for the specific purpose for which it was originally obtained. What privacy principle is the corporation emphasizing with this requirement?
- AStorage Limitation
- BPurpose Limitation
- CAccuracy
- DData Minimization
Show answer & explanationAnswer & explanation
Correct answer: B. Purpose Limitation
Purpose Limitation dictates that personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes. This aligns directly with the requirement that data 'must only be collected and processed for the specific purpose for which it was originally obtained.'
Why the other options are wrong
- A. Storage Limitation refers to retaining data only for as long as necessary.
- C. Accuracy refers to keeping data correct and up-to-date.
- D. Data Minimization is collecting only necessary data, not limiting its use once collected for a purpose.
Purpose Limitation
A privacy principle stating that personal data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
- Data use tied to original collection purpose.
- Prevents scope creep in data processing.
- Core principle in privacy regulations (e.g., GDPR).
Memory trick: My Data's Purpose is Clear, My Data's Stay is Short Here.